CVE-2022-25337

The CVE-2022-25337 entry affects Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12, where image filename handling allows injection attacks. The connected sources confirm the vulnerability is tied to image filename sanitization issues, enabling injection thr...

CVE-2022-48367

An issue in eZ Publish Ibexa Kernel prior to 7.5.28 permits improper access control based on object state, leading to potential unauthorized access. CVSS v3.1 base score 9.8 (CRITICAL); attack vector NETWORK, no user interaction. A remediation is to upgrade to 7.5.28 or later per the associated a...

CVE-2022-25336

CVE-2022-25336 affects Ibexa DXP Ezpublish-kernel: versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12. The issue is an Insecure Direct Object Reference (IDOR) against image files because the image path and filename can be inferred, enabling access to potentially sensitive images. Connected sour...

CVE-2022-48366

CVE-2022-48366 affects eZ Platform Ibexa Kernel prior to 1.3.19, enabling an attacker to determine whether an account exists via a timing attack (remote, no auth, no user interaction). The CVSS v3.1 vector indicates network access, high attack complexity, and no privileges required, with a low co...

CVE-2022-48365

The CVE-2022-48365 issue affects eZ Platform Ibexa Kernel before 1.3.26, where the Company admin role grants excessive privileges. Impact includes elevated access to perform actions that should be restricted. The vulnerability is rooted in improper privilege management for the admin role, allowin...

CVE-2021-46876

Affected product: eZ Publish Ibexa Kernel prior to 7.5.15.1. Vulnerability: the /user/sessions endpoint can be abused to determine whether a given username or email corresponds to a valid account, enabling information disclosure. Underlying cause: listed in CVE description as an account-existence...

CVE-2021-46875

CVE-2021-46875 affects eZ Platform Ibexa Kernel prior to 1.3.1.1. Multiple sources (NVD, Red Hat, CVE listing) describe a Cross-Site Scripting (XSS) vulnerability where JavaScript can be uploaded in .html or .js files, enabling script execution when victims access the uploaded content. The core i...